Massive Phishing Campaign Bypasses Multi-Factor Authentication, Hits 35,000 Users

Over 35,000 users hit by phishing using fake emails to hijack sessions and bypass MFA. Learn how to protect your organization today.

By Content Team

May 6, 2026

ON THIS PAGE

A sophisticated phishing attack targeted over 35,000 users across 13,000 organizations between April 14-16, 2026, using fake "code of conduct" emails to steal credentials. The attackers used adversary-in-the-middle (AiTM) techniques to bypass multi-factor authentication by hijacking active login sessions in real-time.

The campaign primarily hit the United States (92% of victims) and targeted healthcare, financial services, and technology sectors. Victims received professional-looking emails claiming conduct violations, with PDF attachments leading to fake Microsoft login pages. The attackers positioned themselves between users and legitimate Microsoft services, capturing authentication tokens that provided direct account access without passwords.

Microsoft Defender Research tracked the campaign, noting its use of legitimate email services and polished HTML templates that made detection difficult. Organizations should enable phishing-resistant MFA methods like FIDO keys and implement comprehensive email security measures.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?